General
-
Target
JaffaCakes118_9fa4629775d115d3611c522b04a4181184df0f5429cb009c65872e67022e1f08
-
Size
416KB
-
Sample
241221-ymemjaykcn
-
MD5
9455159e4519343fb3481f31a92746d9
-
SHA1
4ddcbd90bb4ff34aca9cc04867827b266a5dad96
-
SHA256
9fa4629775d115d3611c522b04a4181184df0f5429cb009c65872e67022e1f08
-
SHA512
c471fc6f59464cfffa893b4a6185e638f8fb5c272e22529da5938a21dc45eb4b28dc6444d6d024a4c65b36890229972d38c3977eb3a4b3ac07e1d4a16d176c55
-
SSDEEP
12288:Khio+bY3mYK9nPiMmw6vciHh2eMXTIFNBhO9htp:oiDbY3vK9PihjAe2TIFhGtp
Malware Config
Extracted
trickbot
1000514
mor125
51.89.163.40:443
89.223.126.186:443
45.67.231.68:443
148.251.185.165:443
194.87.110.144:443
213.32.84.27:443
185.234.72.35:443
45.89.125.148:443
195.123.240.104:443
185.99.2.243:443
5.182.211.223:443
195.123.240.113:443
85.204.116.173:443
5.152.210.188:443
103.36.48.103:449
36.94.33.102:449
36.91.87.227:449
177.190.69.162:449
103.76.169.213:449
179.97.246.23:449
-
autorunName:pwgrab
Targets
-
-
Target
faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350.exe
-
Size
678KB
-
MD5
26aca67e755b79679663436a4996ddbf
-
SHA1
92aaef7ce303ad5aeeb09c0acd38be75affc6f2d
-
SHA256
faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350
-
SHA512
bd98a1712a883632374b028eaf0a615709319571effdf569249f483c1fe0ff86f14370026f18ea9e42fbf2aa772a27da8ba318d7919dff2dd282be300d401ebc
-
SSDEEP
12288:uqluOGXcc5O95gTHGJGxc/Mi1qF6gnc4DYTP3EEyB7u/adsNDQmTHzRXy2EGkGux:uOu1CwamU+svEEs5sNDpTRXPhA
Score10/10-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Trickbot family
-
Dave packer
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
-